CVE catalog

CVE-2025-32898

gnome-shell-extension-gsconnect: CVE-2025-32898

[CVE catalog]

Severity
Medium · CVSS 4.7CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N
Published
Source
[NVD] · [CVE record]
EPSS
0.15% · Oct 27, 2026

The KDE Connect verification-code protocol before 2025-04-18 uses only 8 characters and therefore allows brute-force attacks. This affects KDE Connect before 1.33.0 on Android, KDE Connect before 25.04 on desktop, KDE Connect before 0.5 on iOS, Valent before 1.0.0.alpha.47, and GSConnect before 59.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debiankdeconnectsid26.08.2-1fixed
Debiankdeconnectforky26.08.2-1fixed
Debiankdeconnecttrixie25.04.2-1+deb13u1fixed
Debiankdeconnecttrixie-security25.04.2-1+deb13u1fixed
Debiankdeconnectbookworm22.12.3-1vulnerable
Debiangnome-shell-extension-gsconnectsid74-1fixed
Debiangnome-shell-extension-gsconnectforky74-1fixed
Debiangnome-shell-extension-gsconnecttrixie62-1+deb13u1fixed
Debiangnome-shell-extension-gsconnecttrixie-security62-1+deb13u1fixed
Debiangnome-shell-extension-gsconnectbookworm54-2vulnerable
Ubuntukdeconnect16.040.8-0ubuntu5vulnerable
Ubuntukdeconnect18.041.0.3-0ubuntu2vulnerable
Ubuntukdeconnect18.041.2.1-0ubuntu1vulnerable
Ubuntukdeconnect18.041.2.1-0ubuntu2vulnerable
Ubuntukdeconnect18.041.3.0-0ubuntu1vulnerable
Ubuntukdeconnect18.041.3.1-0ubuntu0.1vulnerable
Ubuntukdeconnect18.041.3.3-0ubuntu0.18.04.1vulnerable
Ubuntugnome-shell-extension-gsconnect20.0420-0ubuntu1vulnerable
Ubuntukdeconnect20.041.3.5-0ubuntu1vulnerable
Ubuntukdeconnect20.041.4-0ubuntu1vulnerable
Ubuntukdeconnect20.041.4-0ubuntu2vulnerable
Ubuntukdeconnect20.041.4-0ubuntu3vulnerable
Ubuntukdeconnect20.041.4-0ubuntu4vulnerable
Ubuntukdeconnect20.041.4-0ubuntu5vulnerable
Ubuntugnome-shell-extension-gsconnect22.0420-0ubuntu2vulnerable
Ubuntugnome-shell-extension-gsconnect22.0448-0ubuntu2vulnerable
Ubuntugnome-shell-extension-gsconnect22.0448-0ubuntu3vulnerable
Ubuntugnome-shell-extension-gsconnect22.0448-0ubuntu4vulnerable
Ubuntugnome-shell-extension-gsconnect22.0450-0ubuntu1vulnerable
Ubuntukdeconnect22.0421.08.1-0ubuntu1vulnerable
Ubuntukdeconnect22.0421.08.1-0ubuntu2vulnerable
Ubuntukdeconnect22.0421.08.3-0ubuntu1vulnerable
Ubuntukdeconnect22.0421.08.3-1ubuntu1vulnerable
Ubuntukdeconnect22.0421.11.80-0ubuntu1vulnerable
Ubuntukdeconnect22.0421.11.90-0ubuntu1vulnerable
Ubuntukdeconnect22.0421.11.90-0ubuntu2vulnerable
Ubuntukdeconnect22.0421.12.0-0ubuntu1vulnerable
Ubuntukdeconnect22.0421.12.1-0ubuntu1vulnerable
Ubuntukdeconnect22.0421.12.2-0ubuntu1vulnerable
Ubuntukdeconnect22.0421.12.3-0ubuntu1vulnerable
Ubuntugnome-shell-extension-gsconnect24.0455-4vulnerable
Ubuntugnome-shell-extension-gsconnect24.0456-1vulnerable
Ubuntugnome-shell-extension-gsconnect24.0457-1vulnerable
Ubuntukdeconnect24.0423.08.1-0ubuntu1vulnerable
Ubuntukdeconnect24.0423.08.2-0ubuntu1vulnerable
Ubuntukdeconnect24.0423.08.3-0ubuntu1vulnerable
Ubuntukdeconnect24.0423.08.4-0ubuntu1vulnerable
Ubuntukdeconnect24.0423.08.5-0ubuntu1vulnerable
Ubuntukdeconnect24.0423.08.5-0ubuntu4vulnerable
Ubuntukdeconnect24.0423.08.5-0ubuntu5vulnerable
Ubuntukdeconnect25.1024.12.3-0ubuntu2vulnerable
Ubuntukdeconnect25.1025.04.0-0ubuntu1vulnerable
Ubuntukdeconnect25.1025.04.0-0ubuntu2vulnerable
Ubuntukdeconnect25.1025.04.1-0ubuntu1vulnerable
Ubuntukdeconnect25.1025.04.2-0ubuntu2vulnerable
Ubuntukdeconnect25.1025.04.2-1ubuntu1vulnerable
Ubuntukdeconnect25.1025.04.3-0ubuntu1vulnerable
Ubuntukdeconnect25.1025.07.80-0ubuntu1vulnerable
Ubuntukdeconnect25.1025.07.90-0ubuntu1vulnerable
Ubuntukdeconnect25.1025.08.0-0ubuntu1vulnerable
Ubuntukdeconnect25.1025.08.1-0ubuntu1vulnerable
Ubuntukdeconnect25.1025.08.1-0ubuntu2vulnerable
Ubuntukdeconnect25.1025.08.1-0ubuntu2.1vulnerable
Ubuntukdeconnect26.0425.08.1-0ubuntu2vulnerable
Ubuntukdeconnect26.0425.08.2-0ubuntu2vulnerable
Ubuntukdeconnect26.0425.08.3-0ubuntu1vulnerable
Ubuntukdeconnect26.0425.11.80-0ubuntu1vulnerable
Ubuntukdeconnect26.0425.11.80-0ubuntu2vulnerable
Ubuntukdeconnect26.0425.11.90-0ubuntu1vulnerable
Ubuntukdeconnect26.0425.12.0-0ubuntu1vulnerable
Ubuntukdeconnect26.0425.12.1-0ubuntu1vulnerable
Ubuntukdeconnect26.0425.12.1-0ubuntu2vulnerable
Ubuntukdeconnect26.0425.12.2-0ubuntu1vulnerable
Ubuntukdeconnect26.0425.12.2-0ubuntu3vulnerable
Ubuntukdeconnect26.0425.12.3-0ubuntu1vulnerable

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debiankdeconnectsourcesid25.04.0-1not yet assignedNot reportedNot reported
Debiankdeconnectsourceforky25.04.0-1not yet assignedNot reportedNot reported
Debiankdeconnectsourcetrixie25.04.0-1not yet assignedNot reportedNot reported
Debiankdeconnectsourcebookworm(unfixed)not yet assignedNot reportedNot reported
Debiangnome-shell-extension-gsconnectsourcesid62-1not yet assignedNot reportedNot reported
Debiangnome-shell-extension-gsconnectsourceforky62-1not yet assignedNot reportedNot reported
Debiangnome-shell-extension-gsconnectsourcetrixie62-1not yet assignedNot reportedNot reported
Debiangnome-shell-extension-gsconnectsourcebookworm(unfixed)not yet assignedNot reportedNot reported

Notes

[bookworm] kdeconnect: Minor issue, design limitation of protocol version prior to 8 [bookworm] gnome-shell-extension-gsconnect: Minor issue, design limitation of protocol version prior to 8

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [gnome-shell-extension-gsconnect]Affected
    Details (2)

    • 54-2 · all · bookworm

      Affected

      dsa · gnome-shell-extension-gsconnect · debian · bookworm; dsa · gnome-shell-extension-gsconnect · debian · 12

    • 54-2 · all · bookworm

      Affected

      dsa · gnome-shell-extension-gsconnect · debian · bookworm; dsa · gnome-shell-extension-gsconnect · debian · 12

  • [gnome-shell-extension-gsconnect-browsers]Affected

    Source package: [gnome-shell-extension-gsconnect]

    Details (2)

    • 54-2 · all · bookworm

      Affected

      dsa · gnome-shell-extension-gsconnect · debian · bookworm; dsa · gnome-shell-extension-gsconnect · debian · 12

    • 54-2 · all · bookworm

      Affected

      dsa · gnome-shell-extension-gsconnect · debian · bookworm; dsa · gnome-shell-extension-gsconnect · debian · 12

  • [kdeconnect]Affected
    Details (2)

    • 22.12.3-1 · amd64 · bookworm

      Affected

      dsa · kdeconnect · debian · bookworm; dsa · kdeconnect · debian · 12

    • 22.12.3-1 · arm64 · bookworm

      Affected

      dsa · kdeconnect · debian · bookworm; dsa · kdeconnect · debian · 12

  • [nautilus-kdeconnect]Affected

    Source package: [kdeconnect]

    Details (2)

    • 22.12.3-1 · all · bookworm

      Affected

      dsa · kdeconnect · debian · bookworm; dsa · kdeconnect · debian · 12

    • 22.12.3-1 · all · bookworm

      Affected

      dsa · kdeconnect · debian · bookworm; dsa · kdeconnect · debian · 12

[Debian 13 (Trixie)]

  • [gnome-shell-extension-gsconnect]Fixed
    Details (4)

    • 62-1+deb13u1 · all · trixie

      Fixed · Fixed: 62-1

      dsa · gnome-shell-extension-gsconnect · debian · 13

    • 62-1+deb13u1 · all · trixie

      Fixed · Fixed: 62-1

      dsa · gnome-shell-extension-gsconnect · debian · 13

    • 62-1+deb13u1 · all · trixie-security

      Fixed · Fixed: 62-1

      dsa · gnome-shell-extension-gsconnect · debian · 13

    • 62-1+deb13u1 · all · trixie-security

      Fixed · Fixed: 62-1

      dsa · gnome-shell-extension-gsconnect · debian · 13

  • [gnome-shell-extension-gsconnect-browsers]Fixed

    Source package: [gnome-shell-extension-gsconnect]

    Details (4)

    • 62-1+deb13u1 · all · trixie

      Fixed · Fixed: 62-1

      dsa · gnome-shell-extension-gsconnect · debian · 13

    • 62-1+deb13u1 · all · trixie

      Fixed · Fixed: 62-1

      dsa · gnome-shell-extension-gsconnect · debian · 13

    • 62-1+deb13u1 · all · trixie-security

      Fixed · Fixed: 62-1

      dsa · gnome-shell-extension-gsconnect · debian · 13

    • 62-1+deb13u1 · all · trixie-security

      Fixed · Fixed: 62-1

      dsa · gnome-shell-extension-gsconnect · debian · 13

  • [kdeconnect]Fixed
    Details (4)

    • 25.04.2-1+deb13u1 · amd64 · trixie

      Fixed · Fixed: 25.04.0-1

      dsa · kdeconnect · debian · 13

    • 25.04.2-1+deb13u1 · arm64 · trixie

      Fixed · Fixed: 25.04.0-1

      dsa · kdeconnect · debian · 13

    • 25.04.2-1+deb13u1 · amd64 · trixie-security

      Fixed · Fixed: 25.04.0-1

      dsa · kdeconnect · debian · 13

    • 25.04.2-1+deb13u1 · arm64 · trixie-security

      Fixed · Fixed: 25.04.0-1

      dsa · kdeconnect · debian · 13

  • [kdeconnect-libs]Fixed

    Source package: [kdeconnect]

    Details (4)

    • 25.04.2-1+deb13u1 · amd64 · trixie

      Fixed · Fixed: 25.04.0-1

      dsa · kdeconnect · debian · 13

    • 25.04.2-1+deb13u1 · arm64 · trixie

      Fixed · Fixed: 25.04.0-1

      dsa · kdeconnect · debian · 13

    • 25.04.2-1+deb13u1 · amd64 · trixie-security

      Fixed · Fixed: 25.04.0-1

      dsa · kdeconnect · debian · 13

    • 25.04.2-1+deb13u1 · arm64 · trixie-security

      Fixed · Fixed: 25.04.0-1

      dsa · kdeconnect · debian · 13

  • [nautilus-kdeconnect]Fixed

    Source package: [kdeconnect]

    Details (4)

    • 25.04.2-1+deb13u1 · all · trixie

      Fixed · Fixed: 25.04.0-1

      dsa · kdeconnect · debian · 13

    • 25.04.2-1+deb13u1 · all · trixie

      Fixed · Fixed: 25.04.0-1

      dsa · kdeconnect · debian · 13

    • 25.04.2-1+deb13u1 · all · trixie-security

      Fixed · Fixed: 25.04.0-1

      dsa · kdeconnect · debian · 13

    • 25.04.2-1+deb13u1 · all · trixie-security

      Fixed · Fixed: 25.04.0-1

      dsa · kdeconnect · debian · 13

  • [qml6-module-org-kde-kdeconnect]Fixed

    Source package: [kdeconnect]

    Details (4)

    • 25.04.2-1+deb13u1 · amd64 · trixie

      Fixed · Fixed: 25.04.0-1

      dsa · kdeconnect · debian · 13

    • 25.04.2-1+deb13u1 · arm64 · trixie

      Fixed · Fixed: 25.04.0-1

      dsa · kdeconnect · debian · 13

    • 25.04.2-1+deb13u1 · amd64 · trixie-security

      Fixed · Fixed: 25.04.0-1

      dsa · kdeconnect · debian · 13

    • 25.04.2-1+deb13u1 · arm64 · trixie-security

      Fixed · Fixed: 25.04.0-1

      dsa · kdeconnect · debian · 13

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database]